pi-daddy 0.21.1 → 0.23.0

package/CHANGELOG.md

@@ -12,12 +12,61 @@ the record of how the package got here and are worth keeping; they are not worth
 > the record of how the package arrived at what it does, and because the reasoning behind each one is
 > usually the clearest statement of why the current behaviour is what it is.
 
+## 0.23.0 — bounded factory control and retained evidence (2026-09-11)
+
+- Add an opt-in work-ledger v4 contract, strict builders/readers, deterministic fixtures and explicit
+  authority-scoped projection. Ledger v3 remains the default governance format; existing v2/v3 paths and
+  behavior are unchanged.
+- Add opt-in execution retention for exact available process, Herdr and native-session evidence without
+  converting runtime completion into acceptance or claiming unavailable bytes.
+- Add one fixed `linux-bwrap-digest-v1` effect profile with durable aggregate attempt/input/concurrency
+  accounting. It executes package-owned digest/hold code only; arbitrary shell/model profiles, shared
+  writable destinations and aggregate CPU/memory/money enforcement remain unsupported.
+- Add versioned resource dispatch and work-intent controls, bounded experiments and factory orders. Exact
+  authority, CAS, quiescence, reservation and acknowledgement boundaries fail closed; unknown ownership is
+  never replayed, refunded or inferred as success.
+- Add read-only daily projections, retained blind debrief/checkpoint adapters and an explicit dashboard host
+  transport over a private bounded socket. Presentation, steering and cancellation require independently
+  supplied exact authority; refresh remains read-only and does not authenticate a human or module.
+- Retain original ordinary-child cancellation handles and intent admission holds without replacing caller
+  lifetimes. Best-effort terminal observation failure stays visible but no longer permanently poisons a
+  known-settled boundary; required failure, unknown ownership and late coverage still refuse quiescence.
+- Reject benign stale dashboard CAS and immutable-ID mismatches without poisoning the host before any
+  claim/effect. Attempted or uncertain effects retain the existing failed/unknown stop.
+- Remove each newly owned native-profile probe fixture after all probe children settle, on success and
+  failure, without sweeping historical or caller-selected directories.
+- CI now provisions bubblewrap on its ephemeral Ubuntu 26.04 preview runners, records bounded runtime
+  diagnostics and stages a verified job-owned Node runtime. These observations do not establish a general
+  sandbox or a new supported-host guarantee.
+- Add public subpath exports and versioned artifacts for the new work-ledger, resource, experiment,
+  factory-order, effect-profile, retention, debrief and dashboard-host APIs. The workspace root remains
+  private; `pi-daddy` is the only published package. No dependency ranges changed.
+
+## 0.22.0 — fail-closed audit follow-ups (2026-09-04)
+
+- **BREAKING — invalid project stores now fail closed.** Malformed, unsupported, unreadable and wrong-directory
+  stores never restore the ungoverned wildcard; `GRANT_STORE_INVALID` records the safety stop. Repair the store
+  or deliberately rerun `/grants init` rather than relying on invalid state being treated as absent.
+- **BREAKING — explicit delegation models are resolved before any side effect.** Models absent from pi's session
+  catalogue refuse as `MODEL_UNRESOLVED`. Register custom models with pi, or deliberately set the operator
+  escape hatch `PI_GRANTS_ALLOW_UNRESOLVED_MODELS=1`.
+- **BREAKING — correlation inputs are narrower.** `schema_version`, when present, must be exactly `"1.0"`, and
+  `assurance_scope` must use the closed entire-run/selectors union instead of arbitrary JSON. Strict ledger-v3
+  consumers must re-pin to the regenerated schema and fixtures, which also add `GRANT_STORE_INVALID` and
+  `MODEL_UNRESOLVED` to the refusal enum.
+- Supplied `tree_sha` and `last_change_seq` now narrow exact approval reuse. `@types/node >=22` is declared as
+  a peer because the public declarations use `NodeJS.*`.
+- Primary operation errors are preserved when Herdr, named-check, Git-index, or init cleanup also fails. Every
+  finalizer still runs and its failures remain visible; an attached Herdr close failure still retains the
+  workspace writer lease.
+- CI runs the model-free, Herdr-free real-pi integration tier.
+
 ## 0.21.1 — twenty-minute default child timeout (2026-09-02)
 
 - Raise the default per-child wall-clock limit from 600 to 1200 seconds. Explicit
   `PI_GRANTS_CHILD_TIMEOUT` values remain unchanged and inherited by descendants.
 
-## 0.21.0 — one project init enables its ledger (2026-09-01)
+## 0.21.0 — one project init enables its ledger (2026-09-02)
 
 - `/grants init` now atomically persists one project choice containing both the capability grant and default
   `.pi/grants.jsonl`, then adopts both after that write succeeds. Future plain `pi` starts load both, so

package/README.md

@@ -141,7 +141,7 @@ A delegator that legitimately holds `fabric_exec` and knowingly wants a child to
 that child. `assertNarrowing`'s `allowUniversal` flag exists but is deliberately not plumbed through; the
 first real need for that override is the evidence it should be added.
 
-## The two tools
+## The three tools
 
 ```
 delegate({ task: "summarise src/", agent: "docs-writer" })     // preferred: an operator-authored definition
@@ -156,7 +156,7 @@ delegate_all({ children: [ {…}, {…}, {…} ] })                  // several
 - **Spawning is itself a capability.** Grant `delegate` and the child can sub-delegate; withhold it and the
   child is a leaf — the extension is only passed to children that hold it, so the machinery isn't even
   present. `PI_GRANTS_MAX_DEPTH` remains a backstop.
-- **A refusal is a tool *error*, not an answer.** Both tools throw, because `AgentToolResult` has **no
+- **A refusal is a tool *error*, not an answer.** All three tools throw, because `AgentToolResult` has **no
   `isError` field** — pi sets it only when `execute` throws, and a normal return is hardcoded
   `isError: false`. Until 0.5.0 the tool returned `isError: true`, which was silently discarded, so every
   refusal this package made was recorded by pi as a **successful** tool call. Found by the integration suite
@@ -593,6 +593,7 @@ everything below it.
 | `PI_GRANTS_WORKSPACE_REGISTRY` | unset | Operator-owned `{version:1, workspaces:{id:{path}}}` file, required only for workspace-routed spawns. |
 | `PI_GRANTS_WORKSPACE_LEASE_DIR` | under `$PI_CODING_AGENT_DIR/pi-daddy/` | Kernel writer locks and ownership metadata. |
 | `PI_GRANTS_CHILD_TIMEOUT` | `1200` (seconds) | Wall-clock limit for a child. Inherited by descendants — an operator preference, deliberately *not* attenuating state. |
+| `PI_GRANTS_ALLOW_UNRESOLVED_MODELS` | unset | Exact `1` lets pi attempt custom model resolution; otherwise an explicit provider/id missing from pi's session catalogue refuses before lease, approval or spawn. |
 | `PI_GRANTS_FANOUT` | `8` | Per-call width and downward subtree budget; not a session-total counter. Malformed or `0` falls back to the default. |
 | `PI_GRANTS_PARENT_ID` | `d0` | Readable logical tree position; set by the parent and allowed to repeat across calls. |
 | `PI_GRANTS_EXECUTION_ID` | unset at a root | Unique governed execution occurrence; set by the parent. Lifecycle/lease joins use this, never `PI_GRANTS_PARENT_ID`. |
@@ -601,7 +602,9 @@ everything below it.
 | `PI_GRANTS_HERDR_KEEP_PANE` | unset | `1` keeps each child's pane for inspection, and no sweep closes it. Off by default: a fan-out would flood the workspace. |
 | `PI_CODING_AGENT_DIR` | `~/.pi/agent` | pi's own variable, not ours — but it decides where stored project grants/ledger consent and persisted approvals live. |
 
-**A malformed value disables spawning; it never falls back to a default.** An unreadable
+**A malformed value disables spawning; it never falls back to a default.** Stored grants are likewise
+tri-state: only a missing file is opt-out; malformed, unsupported-version, unreadable or wrong-cwd state is a
+loud empty-grant session with a `GRANT_STORE_INVALID` ledger line. An unreadable
 `PI_GRANTS_MAX_DEPTH` or `PI_GRANTS_DEPTH` yields `maxDepth: 0` and a startup warning naming the
 variable. Before 0.5.0 these were read with `parseInt`, which accepts numeric prefixes (`"2abc"` → `2`)
 and otherwise gives `NaN` — and since every comparison against `NaN` is false, a typo did not tighten the
@@ -632,8 +635,10 @@ timed out. A pending running append always lands before a terminal event. `denie
 is invisible without a record.**
 
 Workflow facts are identifier-only and mark `planned`, `observed`, or `controller_validated`; they can never
-claim pi-daddy enforcement. Capability/lifecycle records are the enforced class. Correlation remains a
-caller-declared label; fields eligible for display must use the v3 ASCII identifier grammar rather than prose.
+claim pi-daddy enforcement. Capability/lifecycle records are the enforced class. Correlation remains
+caller-declared: optional `schema_version` is exactly `1.0`, and `assurance_scope` is either entire-run with an
+empty selector list or selectors with one or more non-empty strings. Fields eligible for display use the v3
+ASCII identifier grammar rather than prose.
 
 **Privacy is a property of this file, and the boundary is exact: capability ids, counts and identifiers only
 — never prompts, task text, tool arguments or results.** Trusted `definitionDigest` and `taskDigest` values
@@ -784,9 +789,9 @@ every in-repo test passed. `npm run test:smoke` packs a tarball, installs it int
 ## Testing
 
 ```bash
-npm test                   # 719 unit tests. Fast, pure, no pi, no network.
+npm test                   # 741 unit tests. Fast, pure, no pi, no network.
 npm run typecheck          # src + extensions + tests + integration tests
-npm run test:integration   # 45 tests against a REAL pi process. ~55s, no model tokens.
+npm run test:integration   # 48 tests against a REAL pi process/Herdr server, no model tokens.
 npm run test:smoke         # pack/install; exercise library exports, both bins, the v2/v3 contracts,
                            # bundled Herdr plugin, dashboard, and `pi-daddy init`
 PI_GRANTS_IT_MODEL=1 npm run test:integration   # + 10 end-to-end tests with a real model. Costs money.

package/contracts/daily-view/v1/README.md

@@ -0,0 +1,114 @@
+# P04 daily read-model v1 — input for P07/P08
+
+Implemented candidate, local only. Independent overall review and formal acceptance remain pending.
+This is an actual read-only path through the existing `pi-daddy-dashboard` CLI/Herdr plugin, not a control
+API or an accepted-work counter derived from archive exits. P05 targeted control remains unavailable here.
+
+The authority snapshot has its OWN identity namespace, distinct from the selected work snapshot.
+Current/stale applicability derives from actual P01 claim/selection/matched-receipt validation, not equality
+of those IDs/digests. Missing authority and superseded/mismatched receipts cannot carry acceptance forward.
+The real walking P01 fixture with distinct identities is covered; P01 validation itself is unchanged.
+
+## Pinned P03 input, independent P01 authority
+
+`p03/` vendors exact immutable Git blobs from skill-harness
+`a311df8c991108ada7b6f4b901332232a78e9a44`. `p03/provenance.json` records paths/SHA256. Those schema/fixture
+bytes are unchanged. Input version is exactly `execution-archive-projection-v1`; the reader rejects other
+versions, duplicate JSON members/execution identities, contradictory terminal shapes and lossy numeric
+forms. It supports the adapter's emitted integer-token subset. P03 is always partial/not-assessed.
+
+Work intent is rebuilt with existing `projectWorkLedger` from separately configured strict work-v4 bytes.
+Exact selected scope/obligation revisions and occurrence bindings attach attempts by **executionId**, not
+child names, output labels, file tails, sessions or timestamps. Claimed P03 runtime and P01 runtime remain
+separate; disagreements are diagnostic. P03 conflicts neither grant nor revoke independently supplied P01
+acceptance. All active branches remain null, even if P01 labels or P03 reported sessions contain other hints.
+
+Only a genuine host supplies `workContext` to `readDailyView`/`dashboardFrame`. The reader detaches it before
+I/O and invokes P01 validation; it never manufactures decisions/availability from claims or loads authority
+from a file/environment variable. Missing authority or authority for another selection means unresolved
+acceptance, not zero completed work. Accepted results are explicitly **under supplied snapshot authority**,
+not fresh native approval. The host must independently establish availability/authority when resupplying it.
+
+## Existing view path
+
+The existing plugin command still calls `runDashboard`. Operator-only read settings are forwarded by its
+existing open/reuse seam (no new plugin, worker hook or installation flow):
+
+- `PI_DADDY_ARCHIVE_PROJECTION`: exact P03 snapshot file.
+- `PI_DADDY_WORK_LEDGER`: exact separate work-v4 file.
+- `PI_DADDY_WORK_SNAPSHOT`: JSON containing P01's exact `{snapshot:{id,digest},event:{eventId,digest}}` selection.
+  This is selection **only**, never authority. Pane reuse keys include these settings and their CWD.
+
+CLI equivalents are `--archive-projection`, `--work-ledger`, `--work-snapshot`, plus `--once --no-color` or
+`--once --daily-json`. No new files are discovered, installed or written by a status read. Legacy dashboard
+behavior is unchanged when no daily input is configured. Existing core/plugin protocol validation remains.
+Without a programmatic host-authority context the CLI intentionally cannot show authoritative acceptance.
+
+```ts
+import { readDailyView, createDailyViewReader } from 'pi-daddy/daily-view';
+const read = createDailyViewReader(); // session-local gap metadata, not an authority store
+const view = await read({ archiveProjectionPath, workLedgerPath, workContext: independentlyVerifiedP01Context,
+  sourceManifestFiles: policyAuthorizedManifestPathsBySha256 });
+// renderDailyView(view) is exported from the package root; dashboardFrame({cwd, dailyView: options})
+// invokes the same reader/render path. Rendering an arbitrary caller object is not validation.
+```
+
+## Output contract
+
+`version: "pi-daddy-daily-view-v1"`, `readOnly:true`, `freshness:"snapshot-unknown"`, `coverage:"partial"`.
+Public TypeScript types: `DailyView`, `DailyObligation`, `DailyAttempt`, `DailyViewOptions` in `src/daily-view.ts`.
+The deterministic `fixtures/view.json` and `fixtures/view.txt` are emitted by the actual reader/renderer.
+
+- `scope` is an exact P01 revision or null; `selectedSnapshot` retains the exact selection references.
+- `scopeState`, `authority`, and nullable `progress` are independent of runtime counts. Authority is
+  unavailable, stale-for-selection, or supplied-host-context. Obligations include intent/policy revisions,
+  acceptance, unstarted/attached activity, artifact/evidence coverage, matched receipt IDs, claim sources
+  and obstacle codes. IDs are shown because work-v4 has no verified human description text here.
+- `attempts` preserves exact execution identity, P01 logical child/runtime and separate validated P03 row
+  (parents/public calls/archive IDs/reported sessions/outcome/issues). Reused child names stay separate.
+  `activeBranch` is always null. An archive exit0, including failed-control exit0, is never acceptance.
+- `sourceAvailability` requires actual caller-authorized bytes matching each SHA256. No projection-supplied
+  path/URL is read. Missing mappings/deleted files are missing; mismatches/errors are not recovered facts.
+  Raw-manifest availability does not independently revalidate native transcript/check blobs or provenance.
+- Check/evidence detail comes from P01's authority-aware coverage/receipt matching. P03 v1 has no named-check
+  receipt byte payload; that gap is printed, not inferred from a terminal result or an absent issue string.
+- `sources` reports read/missing/error/unconfigured and exact file hashes. `issues` and `narrative` carry
+  deterministic coverage/obstacle explanations. No raw invalid input/error excerpts are rendered.
+
+Reads are bounded regular non-symlink descriptor snapshots (4 MiB P03, 16 MiB work; at most 128 explicitly
+mapped 64 KiB source manifests). Descriptor/path changes during read become errors. Every refresh rereads
+rather than extending a cached execution history. Missing/error frames do not retain old runtime rows.
+Reconnect produces a resnapshot and sticky gap label, never invented continuity. A new process starts with
+an initial snapshot, not recovered history. Mtime is only a consistency check, never freshness or branch
+proof. Rendering strips terminal control characters and caps lines/columns with visible omissions.
+
+## Supported and BLOCKED scope
+
+Supported: deterministic file-backed read-only view, real CLI and freshly isolated compiled plugin-command
+execution, plus fixture transport wiring through the existing plugin open seam. No worker/model/native-gate
+call is needed. Repeated reads preserve session/control bytes and message counts; disconnected/unavailable
+models do not prevent useful status. Model connectivity itself remains unknown, not falsely "connected".
+
+**BLOCKED live qualification:** no deployed P03 live archive policy/subscription or actual passive live
+transport freshness was supplied. No live Herdr pane/worker observation is claimed; no terminal read,
+scroll, monitoring prompt or control message was used. Installed smoke is separate from isolated compiled
+checks. Full native session/active-branch gaps from P02 and P06's arbitrary-shell/shared-write/aggregate
+CPU-memory-PID-money limitations remain. No accepted packet, fresh source, steering, dispatch or recovery
+can be inferred from the daily view. P07/P08 must preserve these distinctions.
+
+## Fixtures and reproduction
+
+The fixture combines three fixed P01 obligations, two independently reconstructed fixture decisions and
+one exited-but-unaccepted obligation with the exact six-row P03 fixture. P01's known branch labels are
+explicit **test-world declarations**, not authentication of P03's unknown live branches. No authority is
+constructed from incoming wire claims. Separate tests cover unstarted work, missing evidence, changed
+scope/stale authority, unavailable sources, reconnect gaps and read-only repeated operation.
+
+```sh
+node --test packages/pi-daddy/test/daily-view.test.ts
+node packages/pi-daddy/scripts/generate-daily-view-fixture.ts --check packages/pi-daddy/contracts/daily-view/v1/fixtures /absolute/owned/scratch-parent
+```
+
+The generator is repository fixture tooling, imports read-only and writes only explicit owned scratch/new
+targets. Check does not change published fixtures; scratch is retained for inspection. No install, model
+call, per-task review loop, mutation machinery or automatic authority/store update is involved.